Risk Management and Business Continuity
Risk Management and Business Continuity
Risk management is the process of identifying, assessing, and controlling risks. Key steps: identify risks, analyse (likelihood and impact), evaluate (against risk appetite), treat (avoid, reduce, transfer, accept), and monitor. Frameworks include ISO 31000 and COSO ERM. Business continuity management (BCM) focuses on maintaining critical operations during and after a disruption. The BCM lifecycle: analysis (business impact analysis, risk assessment), design (continuity strategies), implementation, testing, and maintenance.
Candidates must understand the difference between risk management and BCM: risk management addresses all risks; BCM specifically addresses disruptive events. A business impact analysis (BIA) identifies critical processes and recovery time objectives (RTOs) and recovery point objectives (RPOs).
Traps include confusing risk avoidance with risk reduction (avoidance eliminates the risk; reduction mitigates it), and assuming that BCM is only about IT disaster recovery (it covers all critical functions). Another trap is treating risk management as a one-off exercise; it should be continuous.
Worked example / rule of thumb: Use a risk matrix (5x5) to prioritise risks: likelihood on one axis, impact on the other. Risks in the high-high quadrant require immediate action. For BCM, calculate RTO (maximum acceptable downtime) and RPO (maximum acceptable data loss). For instance, if a system has an RTO of 4 hours, the continuity strategy must enable recovery within 4 hours. A rule of thumb: invest in controls proportionate to the risk; don’t over-spend on low risks.
Remember that risk appetite is the amount of risk the organisation is willing to accept; risk tolerance is the acceptable variation.